Address Resolution Protocol(ARP): A Way to Know Each Other

If we see computer networks from a high level, it is clear that IP(in IP world) is responsible for carrying traffic from one network to another network. This is a separate topic of study, is called Routing in Cisco’s world. Routing defines how the traffic will flow in the network? what path will be taken? How the routes will be exchanges? That’s itself is a very big

topic. In this post I am most interested in discussing, how traffic flows inside a LAN.

As we all know, communication in LAN happens at layer 2 and we need a MAC address to communicate to each other. But how will I know the MAC address of the other system. There should be some routing protocol to learn MAC address of the other devices. Refer the diagram on the left.

There are five hosts/computers connected to a common link. Now there is something which Ellis wants to give to Jack. But she don’t have Jack’s Address. By the way, if you are in a crowd and want to find a person whose name you know but don’t know his identity, then what will you do. If I am in such situation, probably, I will shout. Ellis knows that she has to reach Jack but she don’t know his identity. So she will shout, “who the hell is Jack, I am Ellis”(ARP request). Everybody will get the message and Morris and Adrian will assume since its not me lets neglect it and they will not respond to Ellis. Jack will listen and will say: Hey! its me(Arp Reply). Now Ellis has already told her name in earlier message, hence Jack will understand, that the person who shouted for me is Ellis and after listening to Jack’s reply Ellis will also come to know that he is Jack.

Hence you probably understood, what is ARP and what it does? ARP stands for Address Resolution protocol. It is the protocol which is used to determine the data link layer address using IP address. So when a packet comes to a host for a new destination, host broadcasts a ARP request at MAC address(ff.ff.ff.ff.ff.ff) mentioning its own MAC address in source Address Column. Broadcast means that ARP request will be sent to everyone in that broadcast domain.MAC address ff.ff.ff.ff.ff.ff is reserved for broadcasts. Any packet destined to ff.ff.ff.ff.ff.ff will be delivered to everyone. Since this is a LAN, hence its fine to have broadcast since we always have ample bandwidth. All the hosts will receive the ARP request and will check the IP in arp request to their own IP. If it does not matches, they will discard the packet but if it matches, the host will send an arp reply mentioning its own MAC address in ARP reply packet.

Below I have shown the captures for ARP request and ARP replies. Please verify, the destination and source addresses in ARP request and ARP replies. They should comply to ARP rules:

All these MAC addresses learnt are normally kept in a table called Arp cache. ARP cache has a timer associated with it. As soon as that timer expires Arp table gets flushed, it is done to get rid of the stale Arp entries.